chore(step): allow specific domains

read the docs finally: https://smallstep.com/docs/step-ca/policies/

Author: crutonjohn

clusters/core/env/production/network-system/step/registration-authority/hr.yaml

@@ -43,8 +43,9 @@ spec:
                   allow:
                     dns:
                       - "*.${FAMILY_DOMAIN}"
-                      - "*.*.${FAMILY_DOMAIN}"
-                      - "*.*.*.${FAMILY_DOMAIN}"
+                      - "*.garage.${FAMILY_DOMAIN}"
+                      - "*.s3.garage.${FAMILY_DOMAIN}"
+                      - "*.web.garage.${FAMILY_DOMAIN}"
                     ip:
                       - "192.168.128.0/20"
                   allowWildcardNames: false